Laravel 5.1 ACL

Question

I've read about the new policy features in Laravel 5.1.

It looks from the docs that a blacklist approach is chosen by default. E.g. a controller actions is possible until access is checked and denied using a policy.

Is it possible to turn this into a whitelist approach? Thus, every controller action is denied except when it's explicitly granted.

Answer 1

I just found a rather clean way I think, in your routes, you pass a middleware and the policy that needs to be checked.

Example code:

<?php

namespace App\Http\Middleware;

use Closure;

class PolicyMiddleware
{
    /**
     * Run the request filter.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @param  string  $policy The policy that will be checked
     * @return mixed
     */
    public function handle($request, Closure $next, $policy)
    {
        if (! $request->user()->can($policy)) {
            // Redirect...
        }

        return $next($request);
    }

}

And the corresponding route:

   Route::put('post/{id}', ['middleware' => 'policy:policytobechecked', function ($id) {
    //
}]);